Detecting evasion attacks at high speeds without reassembly

Abstract

Ptacek and Newsham [14] showed how to evade signature detection at Intrusion Prevention Systems (IPS) using TCP and IP Fragmentation. These attacks are implemented in tools like FragRoute, and are institutionalized in IPS product tests. The classic defense is for the IPS to reassemble TCP and IP packets,and to consistently normalize the output stream. Current IPS standards require keeping state for 1 million connections. Both the state and processing requirements of reassembly and normalization are barriers to scalability for an IPS at speeds higher than 10 Gbps.In this paper, we suggest breaking with this paradigm using an approach we call Split-Detect. We focus on the simplest form of signature, an exact string match, and start by splitting the signature into pieces. By doing so the attacker is either forced to include at least one piece completely in a packet, or to display potentially abnormal behavior (e.g., several small TCP fragments or out-of-order packets) that cause the attacker's flow to be diverted to a slow path. We prove that under certain assumptions this scheme can detect all byte-string evasions. We also show using real traces that the processing and storage requirements of this scheme can be 10% of that required by a conventional IPS, allowing reasonable cost implementations at 20 Gbps. While the changes required by Split-Detect may be a barrier to adoption, this paper exposes the assumptions that must be changed to avoid normalization and reassembly in the fast path.

Evaluating intrusion prevention systems with evasions

“…See, eg, traffic normalization, 28-30 traffic signatures, 31,32 joint work with the target server, 33 and target system emulator. See, eg, traffic normalization, 28-30 traffic signatures, 31,32 joint work with the target server, 33 and target system emulator.…”

“…We deduct 32 which may have caused reassembly to been overlooked in some products. The results of this study indicate that these may have not been properly implemented in some of the tested IPS.…”

Scap

“…Scap shares similar goals with Libnids and Stream5. However, previous works treat TCP stream reassembly as a necessity [50], mostly for the avoidance of evasion attacks against intrusion detection systems [14,19,51]. On the contrary, Scap views transport-layer streams as the fundamental abstraction that is exported to network monitoring applications, and as the right vehicle to implement aggressive optimizations.…”

“…Although previous work treats TCP stream reassembly as a necessary evil [50], used mostly to avoid evasion attacks against intrusion detection and other monitoring systems, we view streams as the fundamental abstraction that should be exported to network monitoring applications, and as the right vehicle for the monitoring system to implement aggressive optimizations all the way down to the operating system kernel and network interface card.…”

Dismantling intrusion prevention systems

“…Caswell and Moore [8] summarized at the time known evasion techniques and introduced some new evasions regarding SMB and MSRPC protocols. Examples of more scientific works to solve the evasion problem include a Sigcomm 2006 paper by Varghese et al [9], and the work by Watson et al [10]. ACM CCS has had many papers in the past on the topic, e.g., Shunting [11].…”